I'm trying to deserialize the following XML using C#:
<stix:STIX_Package xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1" xmlns:stixCommon="http://stix.mitre.org/common-1" xmlns:stix="http://stix.mitre.org/stix-1" xmlns:indicator="http://stix.mitre.org/Indicator-2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="repository:03163c66-23ed-4e7f-8814-be1d08406" version="1.0"> <stix:Indicators> <stix:Indicator id="repository:9df9af32-3b29-4482-81ac-9c090a44db8c" xsi:type="indicator:IndicatorType" negate="false" version="2.0"> <indicator:Title>admin on 24th September 2014 - (1) FileObjects</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab- 1.0">Exfiltration</indicator:Type> <indicator:Description>Some Ex filtration Happened</indicator:Description> </stix:Indicator> <stix:Indicator id="repository:9df9af32-3b29-4482-81ac-9c090a44db8d" xsi:type="indicator:IndicatorType" negate="false" version="2.0"> <indicator:Title>admin on 24th September 2014 - (2) FileObjects</indicator:Title> <indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.0">Exfiltration</indicator:Type> <indicator:Description>Some Ex filtration Happened Again</indicator:Description> </stix:Indicator> </stix:Indicators> </stix:STIX_Package>
My class structure:
[XmlType(AnonymousType = true, Namespace = "http://stix.mitre.org/stix-1")] [XmlRoot(Namespace = "http://stix.mitre.org/stix-1", IsNullable = false)] public class STIX_Package { [XmlArrayItemAttribute("Indicator", IsNullable = false)] public IndicatorType[] Indicators { get; set; } [XmlAttribute] public string id { get; set; } [XmlAttribute] public decimal version { get; set; } } [XmlRoot(ElementName = "Indicator")] [XmlType("Indicator", Namespace = "http://stix.mitre.org/stix-1")] public class IndicatorType : IndicatorBaseType { [XmlElement("Title", Namespace = "http://stix.mitre.org/Indicator-2")] public string Title { get; set; } [XmlElement("Type", Namespace = "http://stix.mitre.org/Indicator-2")] public List<ControlledVocabularyStringType> Type { get; set; } [XmlElement("Description", Namespace = "http://stix.mitre.org/Indicator-2")] public StructuredTextType Description { get; set; } [XmlAttribute, System.ComponentModel.DefaultValueAttribute(false)] public bool negate { get; set; } } [XmlRoot(ElementName = "Indicator")] [XmlInclude(typeof(IndicatorType))] public class IndicatorBaseType { [XmlAttribute] public XmlQualifiedName id { get; set; } [XmlAttribute] public string version { get; set; } } public class ControlledVocabularyStringType { public string vocab_name { get; set; } public string vocab_reference { get; set; } [XmlText] public string Value { get; set; } }
My deserialization code:
using (var stream = new StreamReader("Test.xml")) { var xml = new XmlSerializer(typeof(STIX_Package)); return (STIX_Package) xml.Deserialize(stream); }
Deserialization produces the error:
"System.InvalidOperationException: There is an error in XML document (3, 10). ---> System.InvalidOperationException: The specified type was not recognized: name='IndicatorType', namespace='http://stix.mitre.org/Indicator-2', at http://stix.mitre.org/stix-1'>."
How do I structure/annotate my POCOs so that the XML above can be deserialized?